13
How To Immunize With Novell AppArmor
each of these programs. For instance, adding the line
“
/srv/www/cgi-bin/my_hit_counter.pl rpx,
”
woul
d
gr
ant
Apache permission to execute the PERL script
my_hit_counter.pl
and require that there be a dedicated profile for
my_hit_counter.pl
. If
my_hit_counter.pl
does not have a
dedicated profile associated with it, then the rule should say
“
/srv/www/cgi-bin/my_hit_counter.pl rix,
”
t
o
cause
my_hit_counter.pl
to inherit the
usr.sbin.httpd2-prefork
profile.
Some users may find it inconvenient to specify execute permission for
every CGI script that Apache may invoke. Instead, the administrator
can grant controlled access to collections of CGI scripts. For instance,
addi
ng
t
he
l
i
ne
“
/srv/www/cgi-bin/*.{pl,py,pyc} rix,
”
wi
l
l
allow Apache to execute all files in
/srv/www/cgi-bin/
ending in
.pl
(PERL scripts) or
.py
or
.pyc
(Python scripts). As above, the
“
ix
”
par
t
of
t
he
r
ul
e
causes
t
he
Pyt
hon
scr
i
pt
s
t
o
i
nher
i
t
t
he
Apache
profile, which is appropriate if you do not want to write individual pro-
files for each Python script.
Note:
If you want the Sub-process confinement module
(
mod_change_hat
) functionality when web applications handle
Apache
modules
, (
mod_perl
and
mod_php
), insert the Novell AppAr-
mor sub-process confinement module into the Apache web server.
The Novell AppArmor installer installs this modified Apache web
server along with
change_hat
. Novell AppArmor for Apache is pro-
vided by the
mod_change_hat
Apache module. To take advantage
of
t
he
sub-
pr
ocess
conf
i
nement
,
r
ef
er
t
o
“
Apache ChangeHat
”
on
page 79.
Profiling web applications that use
mod_perl
and
mod_php
require
sl
i
ght
l
y
di
f
f
er
ent
handl
i
ng.
I
n
t
hi
s
case,
t
he
“
pr
ogr
am”
i
s
a
scr
i
pt
i
nt
er
-
preted directly by the module within the Apache process, so no
exec
happens. Instead, the Novell AppArmor version of Apache calls
change_hat()
nami
ng
a
subpr
of
i
l
e
(
a
“
hat
”
)
cor
r
espondi
ng
t
o
t
he
name of the URI being requested.
1
For
mod_perl
and
mod_php
scripts, this will be the name of the PERL script or the PHP page
requested. So for example, adding this subprofile to
foo
will allow the
